Encrypted traffic detection method, network element, terminal, system, medium and device

Abstract

The present disclosure provides an encrypted traffic detection method, network element, terminal, system, medium and equipment, relating to the technical field of communication. The method is applied to a user plane function network element, and the method comprises the following steps: receiving encrypted traffic of an application service sent by a user terminal, wherein the encrypted traffic comprises a first hash value and a session service label, the first hash value is a result of hash operation performed by the user terminal according to its own internet protocol (IP) address information and first verification code information, and the session service label is distributed by a session management function (SMF) network element based on IP address information of the user terminal, application service information of the application service and a policy and charging control (PCC) rule; obtaining associated second verification code information according to the session service label; performing hash operation based on the IP address information of the user terminal and the second verification code information to obtain a second hash value; and detecting the PCC rule associated with the encrypted traffic according to the first hash value and the second hash value. The present method can improve the security of the network.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to an encrypted traffic detection method, a UPF network element, a user terminal, an encrypted traffic detection system, a computer-readable storage medium, and an electronic device. Background Technology

[0002] UPF (User Plane Function), as a 5GC user plane network element, primarily supports UE service data routing and forwarding, data and service identification, and action and policy execution. The UPF network element completes packet detection and classification by receiving PDRs (Packet Inspection Rules) from the control plane.

[0003] Currently, in addition to encryption at the 5G network layer, traffic encryption is also performed between the terminal and the application server. Since the encrypted traffic can avoid being detected, network devices cannot quickly distinguish between encrypted traffic corresponding to normal information and encrypted traffic corresponding to network attacks and spoofing software.

[0004] In summary, how to improve network security between terminals and application servers and avoid network attacks through UPF network elements is a technical problem that urgently needs to be solved in this field.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this disclosure is to provide an encrypted traffic detection method, a UPF network element, a user terminal, an encrypted traffic detection system, a computer-readable storage medium, and an electronic device, so as to at least solve the technical problem of poor network security between user terminals and application servers in related technologies.

[0007] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part by practice of this disclosure.

[0008] The technical solution disclosed herein is as follows:

[0009] According to one aspect of this disclosure, an encrypted traffic detection method is provided, applied to a User Plane Function (UPF) network element. The method includes: receiving encrypted traffic from an application service sent by a user terminal, wherein the encrypted traffic includes a first hash value and a session service tag; the first hash value is the result of a hash operation performed by the user terminal based on its Internet Protocol (IP) address information and a first verification code; the session service tag is assigned by a Session Management Function (SMF) network element based on the user terminal's IP address information, the application service information of the application service, and Policy and Charging Control (PCC) rules; obtaining associated second verification code information based on the session service tag; performing a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and detecting the PCC rules associated with the encrypted traffic based on the first hash value and the second hash value.

[0010] In some embodiments of this disclosure, the first hash value and the session service tag are encapsulated together by the user terminal as an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of encrypted traffic.

[0011] In some embodiments of this disclosure, before obtaining the associated second verification code information based on the session service tag, the process includes: receiving a PCC rule, a session service tag, and associated second verification code information sent by an SMF network element, wherein the second verification code information is obtained by the SMF network element using key derivation processing on the session service tag; establishing an association between the PCC rule, the session service tag, and the second verification code information; and sending a first response message indicating the completion of the association to the SMF network element.

[0012] According to one aspect of this disclosure, an encrypted traffic detection method is provided, applied to a user terminal. The method includes: obtaining a session service tag and first verification code information of an application service, wherein the session service tag is assigned by a session management function (SMF) network element based on the user terminal's Internet Protocol (IP) address information, the application service information of the application service, and Policy and Charging Control (PCC) rules; performing a hash operation based on the IP address information and the first verification code information to obtain a first hash value; obtaining encrypted traffic of the application service based on the session service tag and the first hash value; sending the encrypted traffic to a user plane function (UPF) network element so that the UPF network element obtains associated second verification code information based on the session service tag; performing a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and detecting the PCC rules associated with the encrypted traffic based on the first hash value and the second hash value.

[0013] In some embodiments of this disclosure, obtaining encrypted traffic for application services based on a session service tag and a first hash value includes: encapsulating the first hash value and the session service tag together as an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of the encrypted traffic.

[0014] In some embodiments of this disclosure, obtaining the session service tag and first verification code information of the application service includes: receiving the application service information and the corresponding session service tag of the application service sent by the SMF network element; performing key derivation processing on the session service tag to obtain the first verification code information; establishing an association between the application service information, the session service tag, and the first verification code information; and sending a second response message indicating the completion of the association to the SMF network element.

[0015] According to one aspect of this disclosure, an encrypted traffic detection method is provided. The method includes: an Application Function (AF) network element sending a Policy Provision Request to a Policy Control Function (PCF) network element, the Policy Provision Request including application service information for an application service provided for an Internet Protocol (IP) address of a user terminal; the PCF network element responding to the Policy Provision Request generating corresponding Policy and Charging Control (PCC) rules based on the user terminal's IP address information and application service information, and sending the IP address information, application service information, and corresponding PCC rules to the SMF network element; the SMF network element assigning a unique session service tag based on the user terminal's IP address information, application service information, and PCC rules; using key derivation processing on the session service tag to obtain second verification code information; and sending the session service tag corresponding to the application service information to the user terminal; the user terminal performing key derivation processing on the session service tag to obtain first verification code information; establishing an association between the application service, the session service tag, and the first verification code information, and sending a first response message to the SMF network element; and the SMF network element responding to the user terminal's request by sending a first response message. The first response message sent by the user terminal sends the PCC rule, session service tag, and associated second verification code information to the User Plane Function Management (UPF) network element. After establishing the association between the PCC rule, session service tag, and second verification code information, the UPF network element sends a second response message to the SMF network element. Upon receiving the second response message from the user terminal, the SMF network element sends policy provision response messages to both the PCF and AF network elements, indicating that the PCC rule association has been completed. The user terminal performs a hash operation based on the IP address information and the first verification code information to obtain a first hash value. It then obtains the encrypted traffic of the application service based on the session service tag and the first hash value. The encrypted traffic is sent to the UPF network element to detect the PCC rule associated with the encrypted traffic. The UPF network element receives the encrypted traffic sent by the user terminal. It obtains the associated second verification code information based on the session service tag. It performs a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value. Finally, it detects the PCC rule associated with the encrypted traffic based on the first and second hash values.

[0016] In some embodiments of this disclosure, the first hash value and the session service tag are encapsulated together by the user terminal as an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of encrypted traffic.

[0017] According to one aspect of this disclosure, a User Plane Function (UPF) network element is provided, comprising: an encrypted traffic receiving module for receiving encrypted traffic of an application service sent by a user terminal, wherein the encrypted traffic includes a first hash value and a session service tag, the first hash value being the result of a hash operation performed by the user terminal based on its Internet Protocol (IP) address information and a first verification code, and the session service tag being assigned by a Session Management Function (SMF) network element based on the user terminal's IP address information, the application service information of the application service, and Policy and Charging Control (PCC) rules; a second verification code acquisition module for acquiring associated second verification code information based on the session service tag; a first hash operation module for performing a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and a detection module for detecting PCC rules associated with the encrypted traffic based on the first hash value and the second hash value.

[0018] According to one aspect of this disclosure, a user terminal is provided, comprising: a first verification code acquisition module, configured to acquire a session service tag of an application service and first verification code information, wherein the session service tag is assigned by a session management function (SMF) network element based on the user terminal's Internet Protocol (IP) address information, the application service information of the application service, and policy and charging control (PCC) rules; a second hash operation module, configured to perform a hash operation based on the IP address information and the first verification code information to obtain a first hash value; an encrypted traffic generation module, configured to obtain encrypted traffic of the application service based on the session service tag and the first hash value; and an encrypted traffic sending module, configured to send the encrypted traffic to a user plane function (UPF) network element so that the UPF network element acquires associated second verification code information based on the session service tag; perform a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and detect the PCC rules associated with the encrypted traffic based on the first hash value and the second hash value.

[0019] According to one aspect of this disclosure, an encrypted traffic detection system is provided, comprising: an Application Function (AF) network element, configured to send a Policy Provision Request to a Policy Control Function (PCF) network element, the Policy Provision Request including application service information for application services provided for Internet Protocol (IP) address information of a user terminal; a PCF network element, configured to generate corresponding Policy and Charging Control (PCC) rules based on the application service information according to the IP address information of the user terminal in response to the Policy Provision Request, and send the IP address information, application service information, and corresponding PCC rules to the SMF network element; an SMF network element, configured to allocate a unique session service tag based on the IP address information, application service information, and PCC rules of the user terminal; obtain second verification code information by using key derivation processing on the session service tag; and send the session service tag corresponding to the application service information to the user terminal; a user terminal, configured to perform key derivation processing on the session service tag to obtain first verification code information; establish an association between the application service, the session service tag, and the first verification code information, and send a first response message to the SMF network element; and an SMF network element, further configured to respond to receiving a first verification code message sent by the user terminal. The system responds by sending a PCC rule, a session service tag, and associated second verification code information to the User Plane Function Management (UPF) network element. The UPF network element then associates the PCC rule with the session service tag and the second verification code information before sending a second response message to the SMF network element. The SMF network element, in response to receiving the second response message from the user terminal, sends a policy provision response message to both the PCF network element and the AF (Application Function). This policy provision response message indicates that the PCC rule association has been completed. The user terminal performs a hash operation based on the IP address information and the first verification code information to obtain a first hash value; obtains the encrypted traffic of the application service based on the session service tag and the first hash value; sends the encrypted traffic to the UPF network element to detect the PCC rule associated with the encrypted traffic. The UPF network element also receives the encrypted traffic sent by the user terminal; obtains the associated second verification code information based on the session service tag; performs a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and detects the PCC rule associated with the encrypted traffic based on the first and second hash values.

[0020] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-described encrypted traffic detection method by executing the executable instructions.

[0021] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the above-described encrypted traffic detection method.

[0022] This disclosure proposes a technical solution for UPF to identify encrypted traffic sent by user terminals, which expands the scope of traffic detection and improves the accuracy of traffic identification.

[0023] Furthermore, a unique session service tag and verification code information are associated with the application services of the user terminal, so that the UPF network element can identify the specific information of the application's encrypted traffic, thereby detecting whether the encrypted traffic is legal, which is highly secure and easy to implement, effectively preventing network attacks such as UE impersonation and path tampering, and traffic theft.

[0024] Furthermore, PCC rules are associated with encrypted traffic to verify the legitimacy of the association between encrypted traffic and PCC rules on user terminals, thereby accurately executing PCC rules on encrypted traffic.

[0025] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0027] Figure 1 A schematic diagram of the structure of a wireless communication system applied in an embodiment of this disclosure is shown.

[0028] Figure 2 A flowchart illustrating an encrypted traffic detection method performed by a UPF network element in an embodiment of this disclosure is shown.

[0029] Figure 3 The flowchart illustrates the PCC rule association method in an encrypted traffic detection method executed by a UPF network element according to an embodiment of this disclosure.

[0030] Figure 4 A flowchart illustrating an encrypted traffic detection method performed by a user terminal in an embodiment of this disclosure is shown.

[0031] Figure 5 This illustration shows a flowchart of a method for obtaining the session service tag and the first verification code information of an application service in an encrypted traffic detection method executed by a user terminal according to an embodiment of this disclosure.

[0032] Figure 6 A flowchart of yet another encrypted traffic detection method is shown in this disclosure embodiment.

[0033] Figure 7The diagram illustrates the signaling interaction flowchart of an encrypted traffic detection method according to an embodiment of this disclosure.

[0034] Figure 8 This diagram illustrates a User Plane Function (UPF) network element according to an embodiment of the present disclosure.

[0035] Figure 9 A schematic diagram of a user terminal according to an embodiment of this disclosure is shown.

[0036] Figure 10 A schematic diagram of the structure of an encrypted traffic detection system according to an embodiment of this disclosure is shown.

[0037] Figure 11 A structural block diagram of a computer device for an encrypted traffic detection method according to an embodiment of the present disclosure is shown. Detailed Implementation

[0038] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0039] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0040] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this disclosure, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0041] In view of the technical problems existing in the above-mentioned related technologies, the present disclosure provides an encrypted traffic detection method to solve at least one or all of the above-mentioned technical problems.

[0042] It should be noted that the nouns or terms used in the embodiments of this application can be referenced from each other and will not be repeated here.

[0043] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0044] Figure 1 A schematic diagram of the structure of a communication system according to an embodiment of this disclosure is shown. Figure 1 As shown, the communication system includes: UE 120, radio access network 110 (RAN / AN), and core network. Furthermore, the communication system may also include data network 130 (DN), where DN 130 can refer to a service network that provides data transmission services to users, such as IP multi-media service (IMS) or the Internet.

[0045] In addition, this access network is used to implement functions related to wireless access. This access network may include 3rd Generation Partnership Project (3GPP) access networks and non-3GPP access networks. Access network equipment can refer to network equipment 110a that provides access services to UE 120. Network equipment 110a can be equipment used to communicate with mobile devices. Network equipment can be an access point (AP) in WLAN, a base station (BTS) in GSM or CDMA, a base station (NodeB, NB) in WCDMA, an evolved Node B (eNB or eNodeB) in LTE, a relay station or access point, or in-vehicle equipment, wearable devices, and network equipment (gNB) in NR networks, or network equipment in future evolved PLMN networks, etc.

[0046] The UE user terminal 120 can be a mobile terminal such as a mobile phone, game console, tablet computer, e-book reader, smart glasses, MP4 (Moving Picture Experts Group Audio Layer IV) player, smart home device, AR (Augmented Reality) device, VR (Virtual Reality) device, etc. Alternatively, the user terminal 120 can also be a personal computer (PC), such as a laptop computer and a desktop computer, etc.

[0047] Furthermore, the core network may include the following logical network elements: Session Management Function (SMF) element 140a, Access and Mobility Management Function (AMF) element 140b, Authentication Server Function (AUSF) element 140c, User Plane Function (UPF) element 140d, Application Function (AF) element 140e, Unified Data Management (UDM) element 140f, Policy Control Function (PCF) element 140g, Network Repository Function (NRF) element 140h, Network Exposure Function (NEF) element 140i, and Network Slice Selection Function (NSSF) element 140j, etc. The functions of different core network elements are described below.

[0048] SMF Element 140a: Core network control plane element, mainly responsible for session management in the mobile network, such as session establishment, modification, and release; specific functions include assigning IP addresses to users and selecting UPFs that provide packet forwarding functions.

[0049] AMF element 140b: Core network control plane element, mainly responsible for mobility management in the mobile network, such as user location updates, user registration with the network, and user handover.

[0050] AUSF element 140c: Core network control plane element, a control plane element provided by the operator, used to perform authentication, for example, to perform 3GPP network authentication of its subscribed users.

[0051] UPF element 140d: Core network user plane element, responsible for forwarding and receiving user data in UE. It can receive user data from DN and transmit it to UE through access network equipment; UPF element can also receive user data from UE through access network equipment and forward it to DN.

[0052] AF element 140e: mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.

[0053] UDM network element 140f: Core network control plane element, used to store user subscription data, generate authentication trust letters, process user identifiers (e.g., store and manage user permanent identities), control access authorization, and manage subscription data.

[0054] PCF Network Element 140g: Core network control plane network element, mainly supporting the provision of a unified policy framework to control network behavior, providing policy rules to control layer network functions, and being responsible for obtaining user subscription information related to policy decisions.

[0055] NRF element 140h: Core network control plane element, used to support service discovery functions, and also used to maintain information about available network function elements and the services they support.

[0056] NEF Element 140i: Core network control plane element, mainly responsible for the external exposure of mobile network capabilities.

[0057] NSSF element 140j: A core network control plane element, primarily used for 5G slicing services, such as selecting the target network slice instance (NSI). Optionally, the NSSF element can also be replaced by a network slice specific authentication and authorization function (NSSAAF) element.

[0058] Optionally, in order to implement functions related to authentication and authorization of slices, a network slice-specific authentication and authorization function (NSSAAF) network element can be introduced.

[0059] exist Figure 1 In the communication system shown, the UE can communicate with AMF network element 140b through the N1 interface, the R(AN) device can communicate with AMF network element 140b through the N2 interface, the R(AN) device can communicate with UPF network element 140d through the N3 interface, and UPF network element 140d can communicate with DN 130 through the N4 interface. Additionally, network elements in the core network can communicate through service-oriented interfaces, such as: NNSSF interface, Nnef interface, Nnrf interface, Npcf interface, Nudm interface, Naf interface, Nausf interface, NAMF interface, and Nnsm interface, etc. It is understood that in the above... Figure 1In the communication system shown, the functions and interfaces of each network element are merely illustrative. Not all functions of each network element are required when applied to the embodiments of this application.

[0060] Furthermore, in this application, the communication system may also include an authentication, authorization, and accounting (AAA) server, which may also be referred to as AAA-S. AAA-S can communicate with AMF network element 140b through an intermediate network element that supports communication between AAA-S and AMF network element 140b. This intermediate network element may be AFSF network element 140c, NEF network element 140i, NSSAAF network element, or other network elements used for authentication and authorization processes, etc. Optionally, the communication system may also include an authentication, authorization, and accounting proxy (AAA-P). When AAA-S communicates with AMF network element 140b, AAA-S can first communicate with AAA-P, and AAA-P will send the communication information of AAA-S to AMF network element 140b through intermediate network elements such as AUSF network element 140c, NEF network element 140i, or NSSAAF network element; similarly, AMF network element 140b will send the communication information to AAA-P through intermediate network elements such as AUSF network element 140c, NEF network element 140i, or NSSAAF network element, and AAA-P will then send it to AAA-S.

[0061] Figure 2 This diagram illustrates a flowchart of an encrypted traffic detection method performed by a UPF network element according to an embodiment of this disclosure. The method provided in this embodiment can be applied to... Figure 1 The UPF network element in the wireless communication system shown is illustrated. In the following example, UPF 140d is used as the implementing entity for illustration.

[0062] like Figure 2 As shown, method 200 may include the following steps:

[0063] In step S210, encrypted traffic of application services sent by the user terminal is received. The encrypted traffic includes a first hash value and a session service tag. The first hash value is the result of a hash operation performed by the user terminal based on its Internet Protocol IP address information and first verification code information. The session service tag is assigned by the session management function (SMF) network element based on the user terminal's IP address information, the application service information of the application service, and the policy and charging control (PCC) rules.

[0064] The verification code information is in string format. In some embodiments of this disclosure, the first verification code information is generated according to preset rules. For example, the preset rules may be key derivation processing of the session service tag.

[0065] In some embodiments of this disclosure, IP address information may include a 5-tuple of IP addresses, namely, a set consisting of the source IP address, source port, destination IP address, destination port, and transport layer protocol. For example, 192.168.1.1 10000TCP 121.14.88.76 80 constitutes a 5-tuple, indicating that a terminal with IP address 192.168.1.1 connects to a terminal with IP address 121.14.88.76 on port 80 via port 10000 using the TCP protocol. In some embodiments, the first hash value may be the result of performing a hash operation on the IP 5-tuple and the first verification code.

[0066] In some embodiments of this disclosure, the application service information is the application service ID, also known as the APPID.

[0067] In some embodiments of this disclosure, the session service tag is a unique identifier assigned by the SMF network element based on the user terminal's IP 5-tuple, application service ID, and PCC rules.

[0068] In step S220, the associated second verification code information is obtained based on the session service tag.

[0069] The second verification code information is the verification code information stored locally by the UPF network element.

[0070] In step S230, a hash operation is performed based on the user terminal's IP address information and the second verification code information to obtain a second hash value.

[0071] In some embodiments of this disclosure, the second hash value is the result of performing a hash operation on the IP quintuple and the second verification code.

[0072] In step S240, the PCC rule associated with the encrypted traffic is detected based on the first hash value and the second hash value.

[0073] In some embodiments of this disclosure, if the first hash value and the second hash value are consistent, the verification is successful, and the UPF can continue to execute the PCC rules associated with the encrypted traffic. Correspondingly, the PCC rules are also executed on the encrypted traffic of the downlink. If they are inconsistent, the verification is unsuccessful, which indicates that the association between the encrypted traffic and the PCC is invalid. This allows the UPF network element to identify illegal traffic sent by the user terminal and not to forward the illegal traffic, thereby expanding the scope of traffic detection and improving the accuracy of traffic identification.

[0074] This disclosed method associates a unique session service tag and verification code information with the application service of the user terminal, so that the UPF network element can identify the specific information of the application's encrypted traffic and thus detect whether the encrypted traffic is legitimate. It has high security and is easy to implement, effectively preventing network attacks such as UE impersonation and path tampering, and traffic theft.

[0075] Furthermore, PCC rules are associated with encrypted traffic to verify the legitimacy of the association between encrypted traffic and PCC rules on the user terminal, thereby accurately executing the PCC rules for encrypted traffic.

[0076] In some embodiments of this disclosure, the first hash value and the session service tag are encapsulated together by the user terminal as an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of encrypted traffic.

[0077] By encapsulating information in an extension header between the PDCP and IP layers, the length of the IP layer message is not changed, the payload of the encrypted data is not affected, and the message overhead of the IP layer is reduced.

[0078] Figure 3 This diagram illustrates a flowchart of the PCC rule association method in an encrypted traffic detection method executed by a UPF network element according to an embodiment of this disclosure. The method provided in this embodiment can be applied to... Figure 1 The UPF network element in the wireless communication system shown is illustrated. In the following example, UPF 140d is used as the implementing entity for illustration.

[0079] like Figure 3 As shown, method 300 may include the following steps:

[0080] In step S310, the PCC rule, session service tag and associated second verification code information sent by the SMF network element are received. The second verification code information is obtained by the SMF network element using key derivation processing on the session service tag.

[0081] The session service tag is a unique identifier assigned by the SMF network element based on the user terminal's IP address information, application service information, and PCC rules. In some embodiments, the session service tag is a unique identifier assigned by the SMF network element based on the user terminal's IP 5-tuple information, application service ID, and PCC rules.

[0082] The second verification code is the result of key derivation processing performed by the SMF network element on the session service tag and the preset intermediate key. For example, it can be obtained using any intermediate key in 3GPP and the session service tag through the key derivation function KDF. For instance, the intermediate key could be K... AMF K SEAF etc.; with intermediate key K AMFFor example, the second verification code information XAUC = KDF(K AMF (Session service tag).

[0083] In step S320, the PCC rule is associated with the session service tag and the second verification code information.

[0084] In step S330, a first response message indicating the completion of association is sent to the SMF network element.

[0085] By associating encrypted traffic with PCC rules, session service tags, and derived CAPTCHA information, UPF can identify other associated information of encrypted traffic to verify the association between encrypted traffic and PCC rules, thereby verifying the encrypted traffic.

[0086] Furthermore, by establishing different relationships, it is possible to meet the customized traffic needs of different users for application services, adapt to various business scenarios, and improve the user experience.

[0087] Figure 4 This diagram illustrates a flowchart of an encrypted traffic detection method performed by a user terminal according to an embodiment of this disclosure. The method provided in this disclosure can be applied to... Figure 1 The user terminal (UE) network element in the wireless communication system shown is illustrated. In the following example, UE 120 is used as the implementing entity for illustration.

[0088] like Figure 4 As shown, method 400 may include the following steps:

[0089] In step S410, the session service tag and the first verification code information of the application service are obtained. The session service tag is assigned by the session management function (SMF) network element based on the Internet Protocol IP address information of the user terminal, the application service information of the application service, and the policy and charging control (PCC) rules.

[0090] In some embodiments of this disclosure, the user terminal obtains the session service tag and first verification code information of the application service from the SMF network element. The verification code information is in string format, and in some embodiments of this disclosure, the first verification code information is generated according to a preset rule. For example, the preset rule may be a key derivation process performed on the session service tag and a preset intermediate key.

[0091] In some embodiments of this disclosure, the session service tag is a unique identifier assigned by the SMF network element based on the IP 5-tuple included in the user terminal's IP address information, the application service ID included in the application service information, and the PCC rules.

[0092] In step S420, a hash operation is performed based on the IP address information and the first verification code information to obtain the first hash value.

[0093] In some embodiments of this disclosure, the first hash value may be the result of performing a hash operation on the IP quintuple and the first verification code.

[0094] In step S430, the encrypted traffic of the application service is obtained based on the session service tag and the first hash value.

[0095] In some embodiments of this disclosure, a session service tag and a first hash value are added to the encrypted data packet as encrypted traffic.

[0096] In step S440, encrypted traffic is sent to the User Plane Function (UPF) network element so that the UPF network element obtains the associated second verification code information based on the session service tag; a hash operation is performed based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and the PCC rule associated with the encrypted traffic is detected based on the first hash value and the second hash value.

[0097] In some embodiments of this disclosure, the method by which the UPF network element detects encrypted traffic based on the session service tag and the first hash value carried in the encrypted traffic can be referred to. Figure 2 Method 200 in the text will not be elaborated here.

[0098] This disclosed method enables the identification of illegal traffic between user terminals and application servers, expanding the scope of traffic detection and improving the accuracy of traffic identification. Furthermore, it can identify specific information about encrypted traffic to detect whether the encrypted traffic is legal, which is highly secure and relatively easy to implement. Moreover, by establishing a correlation between encrypted traffic and PCC rules, it can accurately execute the PCC rules for encrypted traffic.

[0099] In some embodiments of this disclosure, the encrypted traffic for the application service obtained by the user terminal based on the session service tag and the first hash value includes: encapsulating the first hash value and the session service tag together into an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of the encrypted traffic.

[0100] This disclosure encapsulates information in an extended header between the PDCP and IP layers of encrypted traffic and sends it to the UPF network element via a user terminal. This eliminates the need to change the length of the IP layer packets, thus preserving the payload of the encrypted data and reducing the packet overhead of the IP layer.

[0101] Figure 5 This diagram illustrates a method flowchart for obtaining the session service tag and first verification code information of an application service in an encrypted traffic detection method executed by a user terminal, according to an embodiment of this disclosure. The method provided in this embodiment can be applied to... Figure 1The user terminal (UE) network element in the wireless communication system shown is illustrated. In the following example, UE 120 is used as the implementing entity for illustration.

[0102] like Figure 5 As shown, method 500 may include the following steps:

[0103] In step S510, the application service information and corresponding session service tag of the application service sent by the SMF network element are received.

[0104] The application service information includes the application service ID, also known as the APPID. In some embodiments of this disclosure, the session service tag is a unique identifier assigned by the SMF network element based on the user terminal's IP address information, application service ID, and PCC rules.

[0105] In step S520, the session service tag is processed by key derivation to obtain the first verification code information.

[0106] The first verification code information is the result of key derivation processing performed by the user terminal on the session service tag and the preset intermediate key. For example, using the intermediate key K... AMF For example, the first verification code information AUC = KDF(K AMF (Session service tag).

[0107] In step S530, the application service is associated with the session service tag and the first verification code information.

[0108] In step S540, a second response message indicating the completion of the association is sent to the SMF network element.

[0109] This disclosed method associates and stores application service and session service tags, along with a first verification code, on the user terminal side. This allows the UPF network element to carry additional related information when sending encrypted traffic to the UPF network element, enabling the UPF network element to verify the legitimacy of the encrypted traffic by recognizing the associated information of the application service. Furthermore, it can meet the customized traffic needs of different users for application services, adapt to various business scenarios, and improve the user experience.

[0110] Figure 6 A flowchart illustrating yet another encrypted traffic detection method according to an embodiment of this disclosure is shown. Figure 6 As shown, the method 600 may include the following steps:

[0111] In step S610, the Application Function (AF) network element sends a policy provision request to the Policy Control Function (PCF) network element. The policy provision request includes application service information for the application services provided for the Internet Protocol (IP) address information of the user terminal.

[0112] The AF network element may include an application server, and the policy provision request includes some application-specific policies created by the AF network element for the user terminal in accordance with the SLA (Service-Level Agreement).

[0113] The application service information includes the application service ID, i.e., APPID.

[0114] The IP address information includes the IP address quintuple.

[0115] In step S620, the PCF network element responds to the policy provision request by generating corresponding PCC rules based on the user terminal's IP address information and application service information, and sends the IP address information, application service information, and corresponding PCC rules to the SMF network element.

[0116] In step S630, the SMF network element assigns a unique session service tag based on the user terminal's IP address information, application service information, and PCC rules; uses key derivation processing on the session service tag to obtain the second verification code information; and sends the session service tag corresponding to the application service to the user terminal.

[0117] In some embodiments of this disclosure, obtaining the second verification code information by using key derivation processing on the session service tag can be achieved by using a key derivation function based on the session service tag and a preset intermediate key, with the preset intermediate key being K. AMF For example, the second verification code information XAUC can be represented as XAUC = KDF(K AMF (Session service tag).

[0118] In step S640, the user terminal performs key derivation processing on the session service tag to obtain the first verification code information; after establishing an association between the application service, the session service tag, and the first verification code information, it sends a first response message to the SMF network element.

[0119] In some embodiments of this disclosure, a preset intermediate key is used as K. AMF For example, the AUC of the first verification code information can be represented as AUC = KDF(K AMF (Session service tag).

[0120] In step S650, in response to receiving the first response message sent by the user terminal, the SMF network element sends the PCC rule, session service tag and associated second verification code information to the User Plane Function Management (UPF) network element.

[0121] In step S660, after the UPF network element completes the association between the PCC rule, the session service tag, and the second verification code information, it sends a second response message to the SMF network element.

[0122] In step S670, in response to receiving the second response message sent by the user terminal, the SMF network element sends a policy provision response message to the PCF network element and the AF network element respectively. The policy provision response message indicates that the PCC rule has been associated.

[0123] In step S680, the user terminal performs a hash operation based on the IP address information and the first verification code information to obtain the first hash value; obtains the encrypted traffic of the application service based on the session service tag and the first hash value; and sends the encrypted traffic to the user plane function UPF network element to detect the PCC rule associated with the encrypted traffic.

[0124] In some embodiments of this disclosure, a first hash value is obtained based on the IP address 5-tuple and the first verification code information. For example, if the first verification code information is XAUC, the first hash value can be represented as HASH(IP address 5-tuple || XAUC), and then the hash result, together with the service tag, is encapsulated as an extension header.

[0125] In step S690, the UPF network element receives encrypted traffic sent by the user terminal; obtains the associated second verification code information based on the session service tag; performs a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and detects the PCC rule associated with the encrypted traffic based on the first hash value and the second hash value.

[0126] In some embodiments of this disclosure, a second hash value is obtained based on the IP quintuple and the second verification code information. For example, if the second verification code information is AUC, then the second hash value can be represented as HASH(IP address quintuple || AUC).

[0127] In some embodiments of this disclosure, if the first hash value matches the second hash value, the UPF network element forwards the encrypted traffic to the AF network element to provide application services to the user terminal, and executes QoS (Quality of Service) and billing rules in the PCC rules on the encrypted traffic. Correspondingly, for the encrypted traffic on the downlink sent to the user terminal, QoS and billing rules in the PCC rules corresponding to the session service tag can also be executed. If the first hash value does not match the second hash value, the UPF network element does not forward the encrypted traffic.

[0128] On the one hand, the method of this disclosure enables UPF network element to identify illegal traffic between user terminals and AF network elements, expands the traffic detection range, and improves the accuracy of traffic identification.

[0129] On another front, the method in this embodiment also associates a unique session service tag and verification code information for the application service of the user terminal through the SMF network element, so that the UPF network element can identify the specific information of the encrypted traffic and detect whether the encrypted traffic is legal. This method is highly secure and easy to implement, effectively preventing network attacks such as UE impersonation and path tampering, and traffic theft.

[0130] In another aspect, the method of this disclosure associates PCC rules with encrypted traffic to verify the legality of associating encrypted traffic of the user terminal with PCC rules, thereby accurately executing the PCC rules of encrypted traffic.

[0131] In some embodiments of this disclosure, the first hash value and the session service tag are encapsulated together by the user terminal as an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of the encrypted traffic. By encapsulating the information in the extension header between the PDCP and IP layers, the length of the IP layer packet does not need to be changed, the payload of the encrypted data is not affected, and the packet overhead of the IP layer is reduced.

[0132] In some embodiments of this disclosure, a mapping relationship between the session service tag, verification code, and PCC rules of encrypted traffic can be established by initiating a Send Protocol Data Unit (PDU) session modification request message to generate a session service tag. For example, the PDU session modification request may include the associated objects such as the user terminal's IP address information, application service information, and PCC rule information. Figure 7 The diagram illustrates a signaling interaction flowchart of an encrypted traffic detection method according to an embodiment of this disclosure. Figure 7 As shown, the encrypted traffic detection method includes the following steps:

[0133] In step S702, AF network element 700f initiates a policy provision request to PCF network element 700d of the core network through NEF network element 700e. The policy provision request includes the IP address information of the user terminal and the application service ID of the application service.

[0134] In step S704, PCF network element 700d responds to the policy provision request by generating corresponding PCC rules based on the user terminal's IP address information and application service information, and initiates a PDU session policy modification request to SMF network element 700b.

[0135] In step S706, the SMF network element 700b assigns a unique session service label based on the user terminal's IP address information, application service information, and PCC rules.

[0136] In step S708, the SMF network element 700b uses key derivation processing on the session service label to obtain the second verification code information.

[0137] In this process, SMF uses a key derivation function to generate a second verification code to verify the encrypted traffic based on the session service tag and a preset intermediate key.

[0138] In step S710, the SMF network element 700b initiates a PDU session modification request to the user terminal 700a, wherein the PDU session modification request includes the application service ID and the corresponding session service tag.

[0139] In step S712, the user terminal 700a generates a first verification code corresponding to the application service ID using a key derivation function based on the session service tag and the preset intermediate key.

[0140] In step S714, after the user terminal 700a establishes an association between the application service, the session service tag, and the first verification code information, it initiates a PDU session modification response to the SMF network element 700b.

[0141] In step S716, the SMF network element 700b sends the QoS execution rule, session service tag, and second verification code information from the PCC rule to the UPF network element 700c via an N4 message.

[0142] In step S718, after the UPF network element 700c completes the association between the QoS rules, the session service tag, and the second verification code information, it sends an N4 session modification response to the SMF network element.

[0143] In step S720, SMF network element 700b returns a PDU session policy modification response to PCF network element 700d.

[0144] In step S722, SMF network element 700b returns a policy response to AF network element 700f through NEF network element.

[0145] In some embodiments of this disclosure, the encrypted traffic detection process of the UPF network element 700c for application services of user terminals may include the following steps:

[0146] In step S724, the user terminal 700a performs a hash operation based on the IP address information and the first verification code information to obtain the first hash value.

[0147] In step S726, user terminal 700a encapsulates the first hash value and session service tag together into an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of encrypted traffic.

[0148] In step S728, encrypted traffic is sent to the User Plane Function (UPF) network element to detect the PCC rules associated with the encrypted traffic.

[0149] In step S730, the UPF network element 700c obtains the associated second verification code information based on the session service tag; performs a hash operation based on the IP address information of the user terminal 700a and the second verification code information to obtain a second hash value; and detects the PCC rule associated with the encrypted traffic based on the first hash value and the second hash value.

[0150] In step S732, the UPF network element 700c executes the QoS and billing rules in the corresponding PCC rules on the verified encrypted traffic.

[0151] In step S734, the UPF network element 700c also forwards the verified encrypted traffic to the AF network element 700f to provide application service data to the user terminal.

[0152] It should be noted that the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0153] Figure 8 This diagram illustrates a User Plane Function (UPF) network element according to an embodiment of this disclosure. Figure 8 As shown, this UPF network element includes the following modules:

[0154] The encrypted traffic receiving module 810 is used to receive encrypted traffic of application services sent by user terminals. The encrypted traffic includes a first hash value and a session service tag. The first hash value is the result of a hash operation performed by the user terminal based on its Internet Protocol IP address information and first verification code information. The session service tag is assigned by the session management function (SMF) network element based on the user terminal's IP address information, the application service information of the application service, and the policy and charging control (PCC) rules.

[0155] The second verification code acquisition module 820 is used to obtain the associated second verification code information based on the session service tag.

[0156] The first hash operation module 830 is used to perform a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value.

[0157] The detection module 840 is used to detect the PCC rules associated with encrypted traffic based on the first hash value and the second hash value.

[0158] In some embodiments of this disclosure, the first hash value and the session service tag are encapsulated together by the user terminal as an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of encrypted traffic.

[0159] In some embodiments of this disclosure, before obtaining the associated second verification code information based on the session service tag, the process includes: receiving a PCC rule, a session service tag, and associated second verification code information sent by an SMF network element, wherein the second verification code information is obtained by the SMF network element using key derivation processing on the session service tag; establishing an association between the PCC rule, the session service tag, and the second verification code information; and sending a first response message indicating the completion of the association to the SMF network element.

[0160] Figure 9 A schematic diagram of a user terminal according to an embodiment of this disclosure is shown. For example... Figure 9 As shown, the user terminal includes the following modules:

[0161] The first verification code acquisition module 910 is used to acquire the session service tag of the application service and the first verification code information. The session service tag is assigned by the session management function SMF network element based on the user terminal's Internet Protocol IP address information, the application service information of the application service, and the policy and charging control (PCC) rules.

[0162] The second hash operation module 920 is used to perform a hash operation based on the IP address information and the first verification code information to obtain the first hash value.

[0163] The encrypted traffic generation module 930 is used to obtain the encrypted traffic of the application service based on the session service tag and the first hash value.

[0164] The encrypted traffic sending module 940 sends encrypted traffic to the User Plane Function (UPF) network element so that the UPF network element obtains the associated second verification code information based on the session service tag; performs a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and detects the PCC rules associated with the encrypted traffic based on the first hash value and the second hash value.

[0165] In some embodiments of this disclosure, the encrypted traffic generation module 930 is further configured to encapsulate the first hash value and the session service tag together into an extension header between the Packet Data Convergence Protocol (PDCP) layer and the Internet Protocol (IP) layer of the encrypted traffic.

[0166] In some embodiments of this disclosure, the first verification code acquisition module 910 is further configured to receive application service information of the application service and the corresponding session service tag sent by the SMF network element; perform key derivation processing on the session service tag to obtain the first verification code information; establish an association between the application service information, the session service tag and the first verification code information; and send a second response message to the SMF network element indicating that the association is completed.

[0167] Figure 10A schematic diagram of an encrypted traffic detection system according to an embodiment of this disclosure is shown. Figure 10 As shown, the system includes:

[0168] Application function AF network element 1010 is used to send policy provision requests to policy control function PCF network element. The policy provision request includes application service information for application services provided for the Internet Protocol IP address information of user terminals.

[0169] PCF network element 1020 is used to respond to policy provision requests by generating corresponding policy and charging control (PCC) rules based on the user terminal's IP address information and application service information, and sending the IP address information, application service information, and corresponding PCC rules to the SMF network element.

[0170] SMF network element 1030 is used to allocate a unique session service tag based on the user terminal's IP address information, application service information, and PCC rules; to obtain a second verification code information by using key derivation processing on the session service tag; and to send the session service tag corresponding to the application service information to the user terminal.

[0171] User terminal 1050 is used to perform key derivation processing on the session service tag to obtain the first verification code information; after establishing an association between the application service, the session service tag, and the first verification code information, it sends a first response message to the SMF network element.

[0172] The SMF network element 1030 is also used to send PCC rules, session service tags and associated second verification code information to the User Plane Function Management (UPF) network element in response to receiving a first response message from the user terminal.

[0173] The UPF network element 1060 is also used to send a second response message to the SMF network element after establishing an association between the PCC rule, the session service tag, and the second verification code information.

[0174] The SMF network element 1030 is also used to respond to the second response message sent by the user terminal. The SMF network element sends a policy provision response message to the PCF network element and the AF respectively. The policy provision response message indicates that the PCC rule has been associated.

[0175] User terminal 1050 is also used to perform a hash operation based on IP address information and first verification code information to obtain a first hash value; obtain encrypted traffic of application service based on session service tag and first hash value; and send the encrypted traffic to user plane function UPF network element to detect the PCC rule associated with the encrypted traffic.

[0176] The UPF network element 1060 is also used to receive encrypted traffic sent by user terminals; obtain associated second verification code information based on the session service tag; perform a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value; and detect the PCC rules associated with the encrypted traffic based on the first hash value and the second hash value.

[0177] Regarding the key generation devices 800, 900, and 1000 in the above embodiments, the specific methods by which each module performs its operations have been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0178] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0179] The following reference Figure 11 To describe an electronic device 1100 according to such an embodiment of the present disclosure. Figure 1 The electronic device 1100 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0180] like Figure 11 As shown, the electronic device 1100 is manifested in the form of a general-purpose computing device. The components of the electronic device 1100 may include, but are not limited to: at least one processing unit 1110, at least one storage unit 1120, and a bus 1130 connecting different system components (including storage unit 1120 and processing unit 1110).

[0181] The storage unit stores program code that can be executed by the processing unit 1110, causing the processing unit 1110 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 1110 can perform actions such as... Figure 2Step S210, as shown, involves receiving encrypted traffic from a user terminal for an application service. The encrypted traffic includes a first hash value and a session service tag. The first hash value is the result of a hash operation performed by the user terminal based on its Internet Protocol (IP) address information and a first verification code. The session service tag is assigned by the Session Management Function (SMF) network element based on the user terminal's IP address information, the application service information of the application service, and the Policy and Charging Control (PCC) rules. Step S220 involves obtaining associated second verification code information based on the session service tag. Step S230 involves performing a hash operation based on the user terminal's IP address information and the second verification code information to obtain a second hash value. Step S240 involves detecting the PCC rules associated with the encrypted traffic based on the first hash value and the second hash value.

[0182] Storage unit 1120 may include readable media in the form of volatile storage units, such as random access memory (RAM) 1121 and / or cache memory 1122, and may further include read-only memory (ROM) 1123.

[0183] Storage unit 1120 may also include a program / utility 1124 having a set (at least one) program module 7205, such program module 1125 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0184] Bus 1130 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0185] Electronic device 1100 can also communicate with one or more external devices (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1100, and / or any device that enables electronic device 1100 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1150. Furthermore, electronic device 1100 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1160. As shown, network adapter 1160 communicates with other modules of electronic device 1100 via bus 1130. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0186] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this disclosure described in the "Exemplary Methods" section above.

[0187] The program product for implementing the above-described method according to embodiments of the present disclosure may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0188] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0189] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0190] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0191] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0192] According to one aspect of this disclosure, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional implementations of the above embodiments.

[0193] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0194] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0195] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0196] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method of encrypted traffic detection, the method comprising: The method applied to a user plane function (UPF) network element comprises the following steps: Receiving encrypted traffic of an application service sent by a user terminal, wherein the encrypted traffic comprises a first hash value and a session service label, the first hash value is a result of hash operation performed by the user terminal according to its own Internet Protocol (IP) address information and first verification code information, and the session service label is distributed by a session management function (SMF) network element based on IP address information of the user terminal, application service information of the application service and a policy and charging control (PCC) rule; Obtaining associated second verification code information according to the session service label; Performing hash operation based on the IP address information of the user terminal and the second verification code information to obtain a second hash value; and Detecting the PCC rule associated with the encrypted traffic according to the first hash value and the second hash value.

2. The encrypted traffic detection method of claim 1, wherein, The first hash value and the session service label are encapsulated together as an extension header between a Packet Data Convergence Protocol (PDCP) layer and an Internet Protocol (IP) layer of the encrypted traffic.

3. The encrypted traffic detection method of claim 2, wherein, Before the step of obtaining associated second verification code information according to the session service label, the method further comprises the following steps: Receiving the PCC rule, the session service label and the associated second verification code information sent by the SMF network element, wherein the second verification code information is obtained by the SMF network element through key derivation processing on the session service label; Associating the PCC rule with the session service label and the second verification code information; and Sending a first response message representing completion of the association to the SMF network element.

4. A method of encrypted traffic detection, the method comprising: The method applied to a user terminal comprises the following steps: Obtaining a session service label and first verification code information of an application service, wherein the session service label is distributed by a session management function (SMF) network element based on Internet Protocol (IP) address information of the user terminal, application service information of the application service and a policy and charging control (PCC) rule; Performing hash operation based on the IP address information and the first verification code information to obtain a first hash value; Obtaining encrypted traffic of the application service according to the session service label and the first hash value; and Sending the encrypted traffic to a user plane function (UPF) network element so that the UPF network element obtains associated second verification code information according to the session service label, performs hash operation based on IP address information of the user terminal and the second verification code information to obtain a second hash value, and detects a PCC rule associated with the encrypted traffic according to the first hash value and the second hash value.

5. The encrypted traffic detection method of claim 4, wherein, The step of obtaining encrypted traffic of the application service according to the session service label and the first hash value comprises the following steps: Encapsulating the first hash value and the session service label together as an extension header between a Packet Data Convergence Protocol (PDCP) layer and an Internet Protocol (IP) layer of the encrypted traffic.

6. The encrypted traffic detection method of claim 5, wherein, The step of obtaining a session service label and first verification code information of an application service comprises the following steps: Receiving application service information of the application service and corresponding session service label sent by the SMF network element; Obtaining the first verification code information through key derivation processing on the session service label; associating the application service information with the session service tag and the first verification code information; and sending a second response message to the SMF network element, the second response message indicating that the association is completed.

7. A method of encrypted traffic detection, the method comprising: The method comprises: sending, by an application function (AF) network element, a policy provision request to a policy control function (PCF) network element, the policy provision request comprising application service information of an application service provided for internet protocol (IP) address information of a user terminal; generating, by the PCF network element, corresponding policy and charging control (PCC) rules according to the IP address information of the user terminal and the application service information in response to the policy provision request, and sending the IP address information, the application service information, and the corresponding PCC rules to an SMF network element; deriving, by the SMF network element, a unique session service tag based on the IP address information of the user terminal, the application service information, and the PCC rules; deriving second verification code information by using a key derivation process on the session service tag; and sending the session service tag corresponding to the application service information to the user terminal; deriving, by the user terminal, first verification code information by using a key derivation process on the session service tag; associating the application service with the session service tag and the first verification code information, and sending a first response message to the SMF network element; sending, by the SMF network element, the PCC rules, the session service tag, and the associated second verification code information to a user plane function management (UPF) network element in response to receiving the first response message sent by the user terminal; sending, by the UPF network element, a second response message to the SMF network element after associating the PCC rules with the session service tag and the second verification code information; sending, by the SMF network element, a policy provision response message to the PCF network element and the AF network element respectively in response to receiving the second response message sent by the user terminal, the policy provision response message indicating that the association of the PCC rules is completed; performing, by the user terminal, a hash operation to obtain a first hash value according to the IP address information and the first verification code information; obtaining encrypted traffic of the application service according to the session service tag and the first hash value; and sending the encrypted traffic to a user plane function (UPF) network element to detect the PCC rules associated with the encrypted traffic; receiving, by the UPF network element, the encrypted traffic sent by the user terminal; obtaining associated second verification code information according to the session service tag; performing a hash operation to obtain a second hash value based on the IP address information of the user terminal and the second verification code information; and detecting the PCC rules associated with the encrypted traffic according to the first hash value and the second hash value.

8. The encrypted traffic detection method of claim 7, wherein, The first hash value and the session service tag are encapsulated together by the user terminal as an extension header between a packet data convergence protocol (PDCP) layer and an internet protocol (IP) layer of the encrypted traffic.

9. A user plane function (UPF) network element, comprising: The UPF network element comprises: The system comprises: The application function AF network element is used for sending a policy providing request to a policy control function PCF network element, wherein the policy providing request comprises application service information of an application service provided for internet protocol IP address information of a user terminal; The PCF network element is used for generating a corresponding policy and charging control PCC rule according to the IP address information of the user terminal and the application service information in response to the policy providing request, and sending the IP address information, the application service information and the corresponding PCC rule to an SMF network element; The SMF network element is used for allocating a unique session service tag based on the IP address information of the user terminal, the application service information and the PCC rule, deriving second verification code information by using a key derivation process on the session service tag, and sending the session service tag corresponding to the application service information to the user terminal; 10. A user terminal, characterized by The user terminal comprises: The first verification code obtaining module is used for obtaining a session service tag of an application service and first verification code information, wherein the session service tag is allocated by a session management function SMF network element based on internet protocol IP address information of the user terminal, application service information of the application service and a policy and charging control PCC rule; The second hash operation module is used for performing hash operation on the IP address information and the first verification code information to obtain a first hash value; The encrypted traffic generation module is used for obtaining encrypted traffic of the application service according to the session service tag and the first hash value; and The encrypted traffic sending module is used for sending the encrypted traffic to a user plane function UPF network element, so that the UPF network element obtains associated second verification code information according to the session service tag, performs hash operation on the IP address information of the user terminal and the second verification code information to obtain a second hash value, and detects the PCC rule associated with the encrypted traffic according to the first hash value and the second hash value.

11. A system for encrypted traffic detection, the system comprising: The system comprises: The application function AF network element is used for sending a policy providing request to a policy control function PCF network element, wherein the policy providing request comprises application service information of an application service provided for internet protocol IP address information of a user terminal; The PCF network element is used for generating a corresponding policy and charging control PCC rule according to the IP address information of the user terminal and the application service information in response to the policy providing request, and sending the IP address information, the application service information and the corresponding PCC rule to an SMF network element; The SMF network element is used for allocating a unique session service tag based on the IP address information of the user terminal, the application service information and the PCC rule, deriving second verification code information by using a key derivation process on the session service tag, and sending the session service tag corresponding to the application service information to the user terminal; The user terminal is configured to perform key derivation on the session service label to obtain first verification code information, and after associating the application service with the session service label and the first verification code information, send a first response message to the SMF network element. The SMF network element is further configured to, in response to receiving the first response message sent by the user terminal, send the PCC rule, the session service label and the associated second verification code information to a user plane function management (UPF) network element. The UPF network element is further configured to, after associating the PCC rule with the session service label and the second verification code information, send a second response message to the SMF network element. The SMF network element is further configured to, in response to receiving the second response message sent by the user terminal, send a policy provision response message to the PCF network element and the AF, respectively, the policy provision response message indicating that the association of the PCC rule is completed. The user terminal is further configured to perform a hash operation on the IP address information and the first verification code information to obtain a first hash value, obtain encrypted traffic of the application service according to the session service label and the first hash value, and send the encrypted traffic to a user plane function (UPF) network element to detect the PCC rule associated with the encrypted traffic. The UPF network element is further configured to receive the encrypted traffic sent by the user terminal, obtain the associated second verification code information according to the session service label, perform a hash operation on the IP address information of the user terminal and the second verification code information to obtain a second hash value, and detect the PCC rule associated with the encrypted traffic according to the first hash value and the second hash value.

12. An electronic device, comprising: comprise: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions to perform the encrypted traffic detection method of any one of claims 1-8.

13. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the encrypted traffic detection method of any one of claims 1-8. The computer program is executed by the processor to implement the encrypted traffic detection method of any one of claims 1-8.

Images